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BEFORE THE BOARD OF PATENT APPEALS AND INTERFERENCES 

Applicant: Steven T. Kirsch PATENT APPLICATION 

Serial No: 08/927,022 Group Art Unit: 2171 

Filed: September 10, 1997 Examining Attorney: C. Rones 

For: DOCUMENT RETRIEVAL SYSTEM WITH ACCESS CONTROL 



Introduction 

This is an appeal of the final rejection of the claims 
1-19 of the above-identified patent application. The final 
rejection was mailed November 8, 2000. A Notice of Appeal was 
filed on May 2, 2001. 
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Status of Claims 



Claims 1-19 are pending in the application. This 
appeal involves claims 1-19, 

Status of Amendments 

An amendment after final rejection was filed on 
February 7, 2001. In the Advisory Action dated February 27, 2001 
the Examiner indicated that the proposed amendment will be 
entered upon filing a Notice of Appeal and an Appeal Brief. 
Applicant submits herewith a copy of the pending claims. 

Real Party In Interest 

This application was assigned to Infoseek Corporation/ 
with the assignment recorded in the United States Patent and 
Trademark Office on December 15, 1997, Reel/Frame 8877/0491 . 
Subsequent to this assignment, the Walt Disney Company acquired 
Infoseek Corporation. Therefore, the Walt Disney Company is the 
real party in interest. 
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Summary of the Invention 

The invention is an electronic document retrieval 
method and system working with a search engine in which documents 
are stored, not on a single computer or server, but in a 
distributed manner over a plurality of servers in a network, 
termed "web servers". Security access is the principal concern, 
but no access levels are contained with the documents themselves. 
See Applicant's specification, abstract, 1 

A user enters his identification together with the 
query to be searched by the search engine. Applicants 
specification, page 2, lines 36-38. The search engine query 
server receives the question and interprets the query operators 
to determine the number of hits responsive to the question. 
Applicant's specification, page 2, line 38 to page 3, line 3. 
Each hit is associated with an electronic document, located at a 
particular server by means of a pointer, known as a URL. 
Applicant's specification, page 3, lines 3-5. 2 "However, before 
the hits are returned to the user, the hits are x screened' by 
determining from the web server whether the user has access using 
an access control list associated with the web server." 
Applicant's Specification, page 3, line 5-9. By the use of URLs 
or pointers, it is possible to associate every document to which 
a user has access with the identification of the user. 
Applicant's specification, abstract. The hierarchical format of 
URLs, allow partial URLs to indicate levels of access. 
Applicant's specification, abstract. 3 The search engine will not 
report the presence of the documents for which the access level 
of the user is insufficient. Applicant's specification, page 3, 



1 This is unlike the traditional and well-known military classification 
system wherein a document is labeled Confidential, Secret or Top Secret. 

2 Note that the query results in "hits", i.e. a list of relevant documents. 
The documents themselves were not requested. 

3 URLs inherently have hierarchical format indicated by slashes. For 
example, uspto.gov/patents is at a higher level than uspto.gov/patents/mpep, 
which is higher than uspto.gov/patents/mpep/chapter 1100, etc. 
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lines 12-14. The web server returns only those documents for 
which the access level is compatible. Applicant's specification, 
page 3, lines 14-15. The result is that the user is prevented 
from discovering the URLs or documents associated with the URLs 
that are not compatible with the access level of the person. 
Applicant's specification, page 3, lines 15-17; and abstract. 

Issues 

The Examiner has stated in the Office action dated 
November 8, 2000 that the formal issue is that "[c]laims 1-8 & 
11-18 are rejected under 35 U.S.C. 103(a) as being unpatentable 
by DuFresne (5 , 835 , 712) . " Office action at 2. 

However, in the Office action, claims 9, 10 and 19 are 
also rejected as being unpatentable over DuFresne as indicated at 
page 8 of the Office action. Therefore, Applicant respectfully 
submits that this rejection should apply to claims 9, 10 and 19 
as well as the other claims mentioned by the Examiner. 

Furthermore, the Examiner states that, "DuFresne 
discloses the claimed invention except for the documents each 
having a security level, with each document and preventing the 
user from discovering the existence of said document titles 
through the use of the search engine . " The Examiner provides 
that Haverstock et al. supplement these missing teachings. 
Office action, at 3. One of these elements is in one of claims 
1, 2, and 4. Claims 2-3 depend from claim 1 and claims 5-12 
depend from claim 4. Therefore, Applicant respectfully submits 
that claims 1-12 have in actuality been rejected as obvious over 
DuFresne in view of Haverstock et al. 

Accordingly, for the reasons stated above, Applicant 
has rewritten the issues as follows: 
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1. Whether claims 1-12 are unpatentable under 35 USC 
§103 (a) over DuFresne (U.S. Patent No. 5,835,712) in 
view of Haverstock et al. (U.S. Patent No. 6,064,977)? 

2. Whether claims 13-19 are unpatentable under 35 USC 
§103 (a) over DuFresne (U.S. Patent No. 5,835,712)? 

Grouping of Claims 

With respect to issue 1, claims 1, 2, 4, 7, and 8 do 
not stand and fall together with each other or the remaining 
claims. Claims 11 and 12 stand and fall together but separately 
from the remaining claims. 

With respect to issue 2, claim 13 stands and falls 
separately from the other claims. Claims 15 and 16 stand and 
fall together but separately from the remaining claims. 

Arguments 

A. 35 U.S.C. S 103 

Under section 103, the scope and content of the prior 
art are examined to determine whether , considering the 
differences between the prior art and the claims at issue, the 
invention, taken as a whole, would have been obvious to a person 
of ordinary skill in the art. 

1. Scope and Content of the Prior Art 

The following U.S. Patents are relied upon by the 
Examiner in the rejection of the claims under appeal. 
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Patentee 
DuFresne 

Haver stock et al. 



Patent No. 

5,835,712 

6,064,977 



Issue Date 
November 10, 1998 
May 16, 2000 



DuFresne discloses the retrieval of a template for 
processing when a client makes a request for the corresponding 
displayable HTML page. In response to a request for a Web page 
from the client, the web server processes HTML tag extensions 
within the template corresponding to the Web page. DuFresne Col. 
3, lines 10-13. The executable tag extensions, identify from a 
database, a field name having a value. 4 Executing the tag 
replaces the tag with the corresponding value. DuFresne, Col. 3, 
lines 6-10. One or more databases are provided that are 
controlled by the processor that store the data values. 
DuFresne, Col. 3, lines 56-57. The template is processed by a 
processor using the tags and an output display page is prepared. 
DuFresne, Col. 9, line 35. 

One aspect of the invention relates to a method of 
controlling user access to a requested page. Each template 
fetched for a requested page includes input fields for entering 
access control lists for specifying authorized users to read, 
write or execute the source in the template. DuFresne, Col. 3, 
line 67 to Col. 4, line 1-2. After a user submits a URL to a 
protected document the server determines whether the URL contains 
an instruction to have access verified by processing the user's 
password and ID. DuFresne, Col. 18, lines 60-67. If not, the 
server retrieves the template to the requested page from the 
database. If there is no access control list in the access 
control field, everyone has access to the document and the server 
merges data into the template preparing the requested page for 
display. DuFresne Col. 19, lines 10-13. If there is an access 



An "executable" tag is a mini computer program that causes a computer to 
do something, in this case fetching a field name from a database. 
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control list, and if the user is specified in the access control 
list then the server grants access to the record and begins 
processing the template to prepare an output display page. 
DuFresne, Col. 19, lines 41-47. 

Haverstock et al. were concerned with a system for 
enabling access to non-HTML objects from a web browser. 
Haverstock et al., abstract. The client is equipped with a 
standard browser. The server comprises web server functionality 
an HTML translator, server software and a database. Haverstock 
et al., Col. 2, lines 51-55. A client with a browser via HTTP, 
enters a URL request received by the HTTP server. Haverstock et 
al., Col. 2, lines 59-60. The HTTP server and the HTML 
translator determine the object specified by the URL, retrieve 
the object, translate it to HTML format and send the HTML 
formatted document to the client. Haverstock et al., Col. 2, 
lines 60-65. 

In one aspect of the invention it is provided that the 
document may contain fields that are access controlled. 
Depending on who the user is one or more of the fields may be 
displayed. Haverstock et al. Col. 6, lines 49-53. This may be 
accomplished through access control lists. Haverstock et al., 
Col. 6, lines 64-65. Using access control lists in conjunction 
with standard web security, the web server can control access to 
HTML objects or specific fields in a page. Haverstock et al., 
col. 7, lines 1-13. 

Haverstock et al. further provides that a user at a "no 
access level" "has no access to the database on the website or 
its associated views and HTML objects.'' Col. 7, lines 21-23. 
"This allows Web developers to easily hide sensitive information 
as a default function of the website." Col. 7, lines 23-25. 

2. Differences Between the Prior Art and the Claims at 

Issue 

With Applicant's claimed invention, the client enters a 
query into a search engine and the hits are retrieved as URLs but 
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are not provided to the client unless they are screened with the 
use of an access control list based upon the hierarchical 
structure of the URL. Therefore, only those documents which the 
client has access to are made retrievable by and known to the 
client. 

In contrast, in both DuFresne and Haverstock et al. the 
user/ client is already aware of the existence of the document as 
he inputs a URL to access the document. DuFresne, Col. 18, lines 
61-63; Haverstock et al., Col. 2, lines 59-60. This is a 
fundamental difference between the prior art and the claimed 
invention. 

In the cited references, if the access list provides 
that the user has access to that particular document then the 
document is retrieved for the user. If the user does not have 
access to the document, the document is not retrieved. However, 
the user is aware of the existence of the web page as he has the 
URL address for the Web page and the user is aware that he was 
denied access. 

Additionally, only a single document is retrieved per 
client request in the cited prior art references of DuFresne and 
Haverstock et al. as a single URL input corresponding to a 
displayable page is made. In contrast, the claimed invention may 
yield many results per query. 

Furthermore, in the prior art, no screening of hits 
takes place, as queries asking for all documents containing the 
queries are never inputted in the method of the prior art 
references. 

Haverstock et al. state that a default function can be 
used to hide the fact that the client was denied access. 
Haverstock et al., Col. 7, lines 23-24. However, in this 
situation, the client is still aware of the existence of the web 
page as he has the URL site. A default function may cause him to 
make inquiries to the controller of the page regarding the 
specific nature of the problem with the page. 

Furthermore, in the claimed invention, a single access 
control list that is not a part of the documents or document 
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index is used to check user authorization when retrieving 
multiple documents. In contrast, in DuFresne, a single template 
for a requested document contains its own access control lists. 
DuFresne, Col. 10, lines 9-10. Haverstock et al. do not teach or 
suggest where the access control lists are located or how they 
are assigned, therefore, Haverstock et al. fails to teach or 
suggest this element and fails to supplement the missing 
teachings. Haverstock et al., Col. 7, lines 1-14. Additionally 
Haverstock et al. provide that more than one access control list 
is used. Haverstock et al., Col. 6, lines 64-65. 

Neither of the references teach nor suggest using the 
hierarchical structure of URLs, i.e. partial URLs, with 
comparison to an access control list. DuFresne does provide that 
partial URLs provided documents containing varying degrees of 
information but fail to teach or suggest using partial URLs for 
matching to an access control list to indicate a hierarchy of 
documents to which a person with a unique identification code has 
access. DuFresne, Col. 7, lines 10-25. Haverstock et al. 
provide that different clients may have access to various fields 
of the same document but do not teach nor suggest the use of 
partial URLs linked to an access control list to indicate a 
hierarchy of documents. Haverstock et al., Col. 7, lines 12-13. 

3 . The Non-Obviousness of Claims 1-12, No Suggestion to 
Combine the References 

The Examiner concludes that it would have been obvious 
to one of skill in the art to modify the DuFresne reference with 
teachings from Haverstock et al. to produce Applicant's claimed 
invention. Office action, at 3. However, Applicant respectfully 
submits that there is no suggestion to combine the references and 
even if the references are combined, a different result is 
produced . 

Haverstock et al. is concerned with a system for 
enabling access to non-HTML documents from a web browser. 
Haverstock et al., abstract. In contrast, DuFresne is focused on 
providing a system where users can access HTML documents in a 
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dynamic environment. In DuFresne, "a processor is employed to 
process templates and to execute [html] tag extensions therein, 
and produces pages in pure HTML form for displaying by any Web 
browser . " DuFresne , abstract . 

Applicant respectfully submits that the Manual of 
Patent Examining Procedure explicitly states that if "the 
proposed modification or combination of the prior art would 
change the principle of operation of the prior art invention 
being modified, then the teachings of the references are not 
sufficient to render the claims prima facie obvious. M.P.E.P. 
S2143.Pl/ M-1338 (Feb. 2000) (citing In re Ratti . 270 F.2d 810,123 
USPQ 349 (CCPA 1959) ) . 

DuFresne provides a method and system for providing 
HTML information exchange between the user and the server for 
HTML documents. The initial request that a user makes in 
DuFresne is for an HTML document. These documents have been 
processed so that each has a corresponding template and such that 
the data is stored in a database retrieveable upon execution of 
tags in the template. DuFresne does not provide for processing a 
query which could lead to non-HTML documents , such as a non-HTML 
website, nor for a situation where a client requests a non-HTML 
document . 

Therefore one of skill in the art would not be 
motivated to combine the DuFresne patent with the Haverstock et 
al. patent. 

4. The 35 U.S. C. S 103 Rejection of Claims 1-12 over 
DuFresne in view of Haverstock et al. 

Assuming arguendo, that there is a suggestion to 
combine the references, Applicants contend that the invention is 
not obvious over the prior art. 

a. Claim 1 

In rejecting claim 1, the Examiner cites to various 
passages in DuFresne as providing support for the rejection. 
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Office action , at 2 and 3. 

However, Applicant respectfully submits that DuFresne 

does not teach or suggest all of the elements of the invention 
recited in Applicant's claim 1. First, DuFresne fails to 
disclose use of a search engine as recited in Applicant's claim 
1. DuFresne discloses a client making a request for a particular 
web page by entering a URL to a protected document. DuFresne, 
Col. 18, lines 61-63. 

In contrast, in Applicant's claimed invention a search 
is conducted with the use of a search engine. Specifically, 
Applicant's claim 1 recites "a search engine having access to all 
documents on the web servers . " 

Additionally, in DuFresne, "[w]hen a client makes a 
request for a particular Web page controlled by the Web server 
20, the server processes the request ... and returns the page to 
the client for display." DuFresne, Col. 6, lines 29-33. In 
DuFresne only one document is retrieved, as is stated in various 
passages throughout the cited reference. DuFresne Col. 9, lines 
26-27; Col. 6, lines 29-33. Therefore there is not a plurality 
of results that are screened. In contrast, Applicant's claim 1 
recites, "screening the search results...." 

A plurality of results are not produced in DuFresne as 
only a single URL is entered corresponding to a single document. 
In contrast Applicant's claim recites "screening the search 
results with the access control list with the access control list 
to determine the documents for which a user performing a search 
has access." 

Next, DuFresne does provide for use of an access 
control list but in association with a single template, not a 
plurality of documents as recited in Applicant's claim. 
DuFresne, Col. 10, lines 9-10. DuFresne provides that two access 
control fields are items in the template that is retrieved upon a 
user's request. DuFresne, Col. 9, lines 55-57. 

In contrast, Applicant's claimed invention provides, 
"the documents associated with an access control list...," In the 
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Applicants claimed invention a plurality of documents are 
associated with a single access control list, but the user never 
knows about documents to which he does not have access. In 
DuFresne, a single fetched template includes two access control 
list fields which will grant or deny access and so a user knows 
of his access level (which may not be desirable) . 

Therefore, for at least these reasons DuFresne fails to 
teach or suggest elements of claim 1. 

The Examiner has stated that DuFresne discloses the 
claimed invention except that DuFresne fails to teach or suggest 
"the documents each having a security level, with each document." 
Office action, at 3. The Examiner provides that Haverstock et 
al. supplements the missing teaching. 

Haverstock et al. fail to supplement the missing 
teachings of DuFresne outlined above. Haverstock et al. provide 
that a user enters a URL therefore, (Haverstock et al., Col. 2, 
lines 59-60) only one document is retrieved from that user. 
Additionally, at Col. 6, lines 51-54, Haverstock et al. provide 
that a document may contain certain fields that are access 
controlled and that authorization allows one to do certain things 
through access control lists. Therefore more than one access 
control list is used per document. Additionally, Haverstock et 
al. fails to teach or suggest where the access control lists are 
stored . 

Therefore, for at least these reasons, Haverstock et 
al. fail to supplement the missing teachings of DuFresne. 
Accordingly, a prima facie case of obviousness has not been 
established. 

b. Claim 2 

In addition to the arguments set forth immediately 
above, claim 2 includes additional features not present in the 
remaining claims suitable to patent protection. 

The Examiner states that passages within the cited 
DuFresne reference provide the element recited in claim 2 of 
"means for forwarding to the user only those document titles 
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compatible with the authorized access of the user, wherein titles 
that are not compatible with the authorized access of the user 
are not forwarded to the user...." Office action, at 3, 

Applicant respectfully submits that DuFresne fails to 
teach or suggest this element of Applicant's claimed invention. 
As stated above, a single URL is entered by the user so that the 
user may retrieve the single document pertaining to that URL, 
DuFresne, Col. 4, lines 30-32; Col. 18, lines 61-63. 

In contrast, in Applicant's claimed invention, as 
recited in claim 2, all of the document titles which the user has 
access to, are forwarded to the user. This differs from DuFresne 
in two ways. First, in Applicant's claim, if the user is 
authorized to have access to multiple document titles then 
multiple document titles are forwarded to the user. In contrast, 
in all cases in DuFresne only a single document is forwarded to 
the user as only a single document was requested and only a 
single document was retrieved. 

Secondly, Applicant's claimed invention recites 
retrieving document titles. In contrast, DuFresne recites 
retrieving a document. 

The Examiner further provides that Haverstock et al. 
discloses another element of Applicant's claim 2 that DuFresne 
fails to teach or suggest. Specifically, "thereby preventing the 
user from discovering the existence of said document titles 
through the use of the search engine." 

Applicant respectfully submits that both DuFresne and 
Haverstock et al. fail to disclose this element. In both 
DuFresne and Haverstock, a user enters a URL to retrieve a single 
document. DuFresne, Col. 4, lines 30-32; Col. 18, lines 61-63; 
Haverstock et al. Col. 3, lines 42-43. If the user does not have 
access to the document, the user will not be able to retrieve the 
document. However, the user is already aware of the existence of 
the document, as the user has entered in a URL corresponding to 
that document. 

In contrast, as Applicant's invention involves the use 
of a search engine, multiple document titles having the search 
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criteria may be retrieved. However, only those document titles 
that the user has access to are forwarded to the user. 
Therefore, the user is prevented from discovering the existence 
of the document titles which he does not have access to. 

The Examiner cites to passages in Haverstock et al. 
which provide that access to certain fields of a document, or 
certain functions such as reading and writing of a document can 
be restricted to certain users. Office action, at 3. However, 
in these cases the user is still aware of the existence of the 
document as the user is viewing the document. The user would 
also be aware of the fact that he could only read on a document 
yet not write to it. Or, if as in Haverstock et al. the user 
were to enter a URL and a default function results in an attempt 
to hide the document, a user may logically inquire as to the 
status of the Web page he was attempting to retrieve. The user 
is still aware of the Web page existence. 

Applicant respectfully points out that the Examiner 
must refrain from using the teachings of the specification in 
determining obviousness. The Federal Circuit articulated this 
well established rule as follows: 

Care must be taken to avoid hindsight reconstruction 
by using *the patent in suit as a guide through the maze of 
prior art references, combining the right reference in the 
right way so as to achieve the results of the claims in 
suit . ' Grain Processing Corp. v. American Maize Products 
Corp. . 840 F.2d 902,907 (Fed. Cir. 1988) 

Therefore, for at least the reasons stated above 
Haverstock et al. fails to supplement the missing teaching of 
DuFresne . 

Accordingly, a prima facie case of obviousness has not 
been established. 

c. Claim 4 

Claim 4 includes additional features not present in the 
remaining claims suitable to patent protection. 
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In rejecting claim 4, (Office action, at 4) the 
Examiner states that DuFresne discloses the following element of 
claim 4: '"executing a query on a query server having access to a 
document index of documents available for searching on document 
servers provided in the web site by a person having a unique 
identification code without regard to access control limitations, 
yielding a list of all relevant documents, each document having a 
unique URL...." 

DuFresne fails to teach or suggest the recited elements 
of "executing a query...yielding a list of all relevant documents 
having a unique URL../' In DuFresne, a query is not executed, 
rather a URL address is inputted. Additionally a list of all 
relevant documents having a unique URL is not provided for in 
DuFresne. In DuFresne a user only enters a single URL therefore, 
only the template corresponding to that URL is retrieved, as is 
stated in various passages throughout the cited reference. 
DuFresne Col. 9, lines 26-27; Col. 6, lines 29-33. DuFresne 
discloses a client making a request for a particular web page by 
entering a URL to a protected document. DuFresne, Col. 18, lines 
61-63. 

In the present invention a user's query yields a list 
of all relevant documents corresponding to that query, each 
document having a unique URL. In contrast, in DuFresne a URL 
yields the template specifically identified by that URL. 

The next element of claim 4 recites, " reviewing all 
URLs by the document servers after the search is executed using 
an access control list associated with each document server to 
check whether each URL is compatible with the access level of the 
identification code of the person executing the query...-" 

As stated above with regard to claim 1, in DuFresne a 
user enters only one URL therefore "all URLs" cannot be reviewed 
as there is only one URL. 

Additionally, each template in DuFresne contains, or is 
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associated with, its own access control lists, 5 DuFresne, Col. 
10, lines 9-10. In the claimed invention each document server is 
associated with a single access control list as recited in the 
claimed invention. An access control list is not contained in 
each document as in the prior art. Furthermore, multiple 
templates in DuFresne have multiple access control lists. In 
contrast, in the present invention each document server having 
multiple documents is associated with a single access control 
list. As provided in the Applicant's specification, "instead of 
multiple control lists, a user enters, either manually or 
automatically, his or her identification, together with the query 
to be searched." Applicant's specification, at page 2, lines 35- 
38. As stated above with regard to claim 1, this element is not 
supplemented by Haverstock et al. 

The next element of claim 4 recites, "delivering only 
those URLs that are compatible with the access level of the 
person, wherein each URL that is not compatible with the access 
level of the person is withheld...." Again, in DuFresne only a 
single URL is entered therefore, only a single document could be 
delivered. 

The final element in claim 4 of "preventing the person 
from discovering the URLs that are not compatible with the access 
level of the person" is the same as claim 2. Therefore, for the 
reasons described above for claim 2 with regards to DuFresne and 
Haverstock et al. Applicant submits that the cited references 
fail to teach or suggest this element of claim 4. 

For the reasons presented above, Applicant submits that 
a prima face case of obviousness has not been established with 
respect to claim 4. 

d. Claim 7 

In addition to the argument set forth immediately 



5 This resembles the prior art military system where each document is 
labeled with a security access label. 
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above, claim 7 include additional features not present in the 
other claims suitable to patent protection. 

Claim 7 recites, "[t]he method of claim 5 further 
defined by storing the access control list separately from the 
documents . " 

In contrast, DuFresne recites that, "[a] template 
includes HTML tags and tag extensions to define and build a Web 
page." DuFresne, Col. 8, lines 66-67. Also, xx [e]ach item in a 
template, such as the ID field 91 and access control fields 92 
and 93 is stored as a field name/value pair in a database. A 
Afield' is the name of an item in a template and the * value' is 
the corresponding data record held by that field." DuFresne, 
Col. 9, lines 55-59. Furthermore, the tag when processed, is 
replaced by the contents of a database field. DuFresne, Col. 
3, lines 14-17 and Col. 12, lines 9-11. Therefore, the access 
control list field of the template when processed is replaced 
with the data from the access control list database. 
Accordingly, the access control list is stored or associated with 
the template document. In contrast, the access control list of 
the present invention as recited in claim 7 is stored separately 
from the document. Therefore, DuFresne fails to teach or suggest 
this element of Applicant's claimed invention. 

Additionally, Haverstock et al. fail to supplement the 
missing teaching. Haverstock et al. provide for the use of 
access control lists but do not provide where the lists are 
stored. Haverstock et al., Col. 6, line3 64-65 and Col. 7, lines 
1-20. Therefore, Haverstock et al. fail to supplement the 
missing teaching. 

Applicant respectfully submits that, xx [t]he consistent 
criterion for determination of obviousness is whether the prior 
art would have suggested to one of ordinary skill in the art that 
this process should be carried out and would have a reasonable 
likelihood of success, viewed in light of the prior art.... Both 
the suggestion and the expectation of success must be founded in 
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the prior art, not in the applicant's disclosure." In re Dow 
Chemical , 5 U.S.P.Q. 2d 1529, 1531 (Fed. Cir. 1988) (citations 
omitted) . As this has not occurred, Applicant submits that a 
prima facie case of obviousness has not been established with 
respect to claim 7. 

e. Claim 8 

In addition to the argument set forth immediately 
above, claim 8 includes additional features not present in the 
remaining claims. 

Claim 8 recites, "[t]he method of claim 4 further 
defined by implementing access control with partial URLs 
indicating the hierarchy of documents to which a person with a 
unique identification has access." 

DuFresne provides that a user can be given different 
URLs and that each URL provides a resulting page that is 
different from the other URLs. URLs may specify the same 
beginning code, however, one URL may be further defined. 
DuFresne, Col. 11, lines 3-25. The more defined URL could 
provide a document that does not have as much information as a 
less defined URL. DuFresne, Col. 11, lines, 3-25. However, 
DuFresne does not teach or suggest, using the hierarchy of URLs 
in conjunction with access control and user identification. 

Haverstock et al. provide that different users can be 
given access to different fields of a page or to different 
functionality levels. Haverstock et al., Col. 7, lines 8-37. 
However, Haverstock et al. does not teach or suggest specifically 
how this is accomplished. 

Therefore, Applicant submits that a prima facie case of 
obviousness has not been established with respect to claim 8. 

f. Claims 11-12 

Claims 11 and 12 include additional features not 
present in the remaining claims suitable to patent protection. 

Claim 11 recites, "[t]he method of claim 5 wherein a 
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single access control list is provided for all document servers." 

Claim 12 recites, "[t]he method of claim 5 wherein an 
access control list is provided for each document server." 

In contrast both DuFresne and Haverstock et al. provide 
for the user of more than one access control list. Specifically, 
DuFresne provides w [p]ref erably, each template is protected by 
the access control lists (ACL's) 92, 93 to limit access to 
specified group of authorized users." DuFresne, Col. 10, lines 9- 
11. Therefore one document template has more than one access 
control list. In Applicant's claimed invention , a single access 
control list is provided for one server or for all document 
servers, not more than one list per document or even more than 
one list per document server. 

Also, as stated above with regard to claims 1, 4 and 7, 
in DuFresne each template corresponding to a single document 
contains its own access control list. In contrast, in the 
present invention each document server having multiple documents 
is provided with a single access control list. 

Additionally, Haverstock et al. fails to supplement the 
missing teaching as it provides, w [authorization: Allowing you 
to so certain things through Access Control Lists ("ACL")...," 
Haverstock et al., Col. 6, lines 64-65. Haverstock et al. provide 
for use of multiple access control lists. Additionally, it does 
not provide specifically how the lists are allocated. 

Therefore, both references fail to teach or suggest use 
of only one access control list per document server or servers as 
recited in claims 11 and 12. 

Accordingly, Applicant submits that a prima facie case 
of obviousness has not been established with respect to claims 11 
and 12. 

5. The 35 U.S.C. S 103 Rejection of Claims 13-19 over DuFresne 
A. Claim 13 

The Examiner has rejected claim 13 as being obvious 
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over DuFresne. Applicant submits that DuFresne fails to render 
claim 13 obvious for at least the following reasons. 

Claim 13 recites, "each document server having an access 
control list..." 

As stated above, with regard to claims 1, 4, 7, 11 and 
12, in DuFresne each template corresponding to a single document 
contains its own access control lists. With the present 
invention, each document server (having multiple documents) has 
one access control list. Therefore, for at least this reason as 
described here and in the argument with regard to claims 1, 4, 7, 
11 and 12, Applicant submits that DuFresne fails to teach or 
suggest this element of Applicant's claimed invention. 

Claim 13 also recites, "defining user identification 
and for each user identification listing URLs for which access is 
permitted or denied...." DuFresne fails to teach or suggest the 
specific method by which it is determined whether users are 
permitted or denied access. DuFresne provides, "the server 403 
retrieves the template to the requested document and further 
determines whether the user is specified in the access control 
list. If the user is properly authorized, the server grants 
access to the record and begins processing the template to 
prepare an output display page 415." DuFresne, Col. 19, lines 41- 
47. However, DuFresne does not further describe how this takes 
place, therefore, fails to teach or suggest the element of 
Applicant's claimed invention reciting for each user 
identification listing URLs for which access is permitted or 
denied. 

The next element of claim 13 recites, "executing a 
query on a query server having access to a document index of 
documents available for searching on the document servers by a 
person having one of said identification code." For at least the 
reasons provided above with regard to claim 4 Applicant submits 
this element is not taught or suggested by DuFresne. 

Claim 13 also recites, "determining by one of the 
document servers whether each URL is compatible with the access 
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level of the identification code of the person; and producing 
only those documents whose URL is compatible with the access 
level of the identification code of the person, wherein each non- 
compatible URL is withheld," 

As stated with regard to claims 1, 2 and 4 only a 
single document is requested and produced in DuFresne et al. 
Accordingly, there is no need to determine if each URL is 
compatible with the access level of the person as only one URL is 
used and only one document corresponding to the URL is provided. 
Applicants claim 13 recites "producing only those documents 
whose URL is compatible with the access level of the 
identification code of the person, wherein each non-compatible 
URL is withheld." Applicants claimed invention produces 
"documents" not a single document as recited in the prior art. 
Non compatible documents are withheld in the claimed invention. 

Applicant respectfully submits that, "[t]he test for 
obviousness, is whether the invention considered as a whole would 
have been obvious or nonobvious. Failure to consider the claimed 
invention as a whole is an error of the law." Jones v. Hardy , 
727 F.2d 1524, 1529 (Fed. Cir. 1984). 

Therefore, Applicant submits that a prima face case of 
obviousness has not been established with respect to claim 13 . 

B. Claims 15 and 16 

Claims 15 and 16 include additional features not 
present in the claims described above suitable to patent 
protection. 

Claim 15 recites, "[t]he method of claim 13 wherein 
each access control list lists URLs for each user identification 
number with a hierarchical indication of documents for which 
access is permitted or denied." 

Claim 16 recites, "[t]he method of claim 15 wherein 
said hierarchical indication of documents is made by partial 
URLs . " 

Applicant submits that DuFresne fails to teach or 
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suggest these elements for at least the reasons stated as above 
with regard to claim 8. DuFresne teaches use of full and basic 
URLs. DuFresne, Col. 11, lines 7-12. However, DuFresne fails to 
teach use of these URLs in conjunction with an access control 
list. As stated in claim 15 to determine whether access to a 
document is permitted or denied "each access control list lists 
URLs for each user identification number with a hierarchical 
indication of documents... . " This is not taught or suggested in 
DuFresne . 

Claim 16 depends on claim 15 and is therefore, 
distinguished from the prior art for at least the same reasons as 
claim 15. 

Therefore, Applicant submits that a prima facie case of 
obviousness has not been established with respect to claims 15 
and 16. 

Relief Sought 

Appellant believes that the pending claims rejected by 
the Examiner were non-obvious to a person of ordinary skill in 
the art because there is no suggestion to combine the teachings 
of DuFresne with those of Haverstock et al., and also because 
assuming arguendo neither of the references teach or suggest all 
of the elements of Applicants claimed invention. Applicant's 
invention operates with a search engine, with access to all 
documents on associated servers, finding documents and then 
transparently providing only those documents for which the user 
has access. The prior art simply does not operate in the search 
engine context. Based on the Applicant's arguments as set forth 
above, the claims are believed to be patentable and Applicant 
respectfully requests that the Examiner's rejections be reversed. 
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APPENDIX 
Claims 

1. (three times amended) A document retrieval system with access 
control for a search engine capable of searching documents 
distributed over web servers in an electronic network comprising, 

one or more web servers having electronic versions of 
documents said documents each having a security level, with each 
document available by request, 

a search engine having access to all documents on the 
web servers, the documents associated with an access control list 
linking the security level of users with the security level of 
documents on the web servers, with the web servers screening the 
search results with the access control list to determine the 
documents for which a user performing a search has access. 
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2. (twice amended) The system of claim 1 further defined by means 
for forwarding to the user only those document titles compatible 
with the authorized access of the user, wherein document titles 
that are not compatible with the authorized access of the user 
are not forwarded to the user thereby preventing the user from 
discovering the existence of said document titles through the use 
of the search engine. 

3. The system of claim 1 further comprising a communications 
link between a query server, connected to the search engine, and 
access control lists associated with the web servers. 
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4. (three times amended) A method of document retrieval in a 
network environment having web sites where documents are stored 
with a plurality of access levels and query servers where 
document searches are launched comprising, 

executing a query on a query server having access to a 
document index of documents available for searching on document 
servers provided in the web site by a person having a unique 
identification code without regard to access control limitations, 
yielding a list of all relevant documents, each document having a 
unique URL, 

reviewing all URLs by the document servers after the 
search is executed using an access control list associated with 
each document server to check whether each URL is compatible with 
the access level of the identification code of the person 
executing the query, 

delivering only those URLs that are compatible with the 
access level of the person, wherein each URL that is not 
compatible with the access level of the person is withheld, and 

preventing the person from discovering the URLs that 
are not compatible with the access level of the person. 

5. The method of claim 4 further defined by providing a data 
link between the query server and access control lists for 
associated web servers. 
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6. The method of claim 5 further defined by storing the access 
control list separately from the index of documents, 

7. The method of claim 5 further defined by storing the access 
control list separately from the documents. 

8. The method of claim 4 further defined by implementing access 
control with partial URLs indicating the hierarchy of documents 
to which a person with a unique identification code has access. 

9. The method of claim 4 further defined by implementing access 
control with a common gateway interface script. 

10. The method of claim 9 wherein said common gateway interface 
script returns a message to the query server indicating URLs to 
which a person with a unique identification code has access. 

11. The method of claim 5 wherein a single access control list 
is provided for all document servers. 
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12. The method of claim 5 wherein an access control list is 
provided for each document server. 

13. (twice amended) A method of document retrieval in a network 
environment having web sites where documents are stored and query 
servers where document searches are launched comprising, 

providing a plurality of document servers in the web 
sites, each having an association with a plurality of documents, 
each document identified with a unique URL, each document server 
having an access control list defining user identification and 
for each user identification listing URLs for which access is 
permitted or denied, 

executing a query on a query server having access to a 
document index of documents available for searching on the 
document servers by a person having one of said identification 
codes, 

determining by one of the document servers whether each 
URL is compatible with the access level of the identification 
code of the person; and 

producing only those documents whose URL is compatible 
with the access level of the identification code of the person, 
wherein each non-compatible URL is withheld. 

14. The method of claim 13 wherein the URLs are expressed in 
HTTP protocol. 
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15. The method of claim 13 wherein each access control list 
lists URLs for each user identification number with a 
hierarchical indication of documents for which access is 
permitted or denied. 

16. The method of claim 15 wherein said hierarchical indication 
of documents is by partial URLs. 

17. The method of claim 13 further defined by accessing the 
access control list by the filesystem of the query server. 

18. The method of claim 13 further defined by accessing the 
access control list by a file transfer protocol. 

19. The method of claim 13 further defined by confirming access 
to the access control list by a script message from a document 
server . 
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